Hacker News Reader

Comment by nl | Hacker News Reader

Whether that's really Russian hackers or just playing the blame game is up for debate of course.

If you are implying there's any doubt about Russian involvement in hacking aimed at the US election, there really isn't any credible doubt about that.

No one argued that ATP-28 and ATP-29 weren't Russian when they hacked the IOC and drug testing labs right after the Russian athletes were banned from the Olympic games.

Nor back in 2014[1] when the FireEye assessment was first done.

Nor in 2015, when they hacked the White House[2]

Nor during 2016, prior to the election when they were identified[3]

It's only after the election that people suddenly don't want to believe it.

[1] https://www.fireeye.com/blog/threat-research/2014/10/apt28-a...

[2] http://www.thedailybeast.com/obama-to-putin-stop-hacking-me

[3] https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

View on HN

How can you be sure?

> How can you be sure?

Don't go down this route. This leads to things like questioning if we can really be 100% super double sure that we landed on the moon, seeing as none of us have any verifiable proof.

Russians were involved in a lot of hacking during the election, and a lot that has surfaced since, like intrusion into power plants, etc.

How do we know this? Because all investigations from the three letter agencies agree on it. Do we have to trust them every time they say they're not spying on us? Or whether they have any active investigations on something? No. But there is no national security or stability reason for them to lie about this. Quite the opposite.

That GP is being downvoted for stating this is disconcerting.

> Because all investigations from the three letter agencies agree on it.

You may want to verify this.

I already have [1]. Are you mistaken or referring to something else?

[1] https://www.dni.gov/files/documents/ICA_2017_01.pdf

All of their reports on all of their investigations into Russian hacking is not included on the declassified document.

Did they investigate voting machine hacking? It's not included in this report.

You're moving goalposts.

The claim you refuted was whether Russians were involved, which they were. Regardless of the amount of classified documents, any new information wouldn't contradict the current public reports of Russian involvement in X. Whether they had involvement in Y is secondary.

Goalposts:

> Blaming things on the Russians was another common thing during the cold war.

I've lost the thread. Are you saying that the major intelligence agencies are merely blaming Russia without basis?

> merely blaming Russia

High confidence, about very specific things. Not all the things, i.e. the goalposts.

> High confidence, about very specific things. Not all the things, i.e. the goalposts.

I'm not being mean, but honestly have a hard time understanding you. Can you explain what you mean in full sentences?

You have to forgive him. Shilling Kremlin talking points in a second language is not as easy as it looks.

Are you this good at sniffing out an immigrant in person as well?

Please don't respond to a bad comment (like a personal attack) by adding one of your own. That also breaks the site guidelines (https://news.ycombinator.com/newsguidelines.html) and does no one any good.

This breaks the HN guidelines egregiously and will get you banned if you do it here, so please don't.

https://news.ycombinator.com/newsguidelines.html

The higher poster was talking about a much larger swathe of accusation of Russia than you were.

Your cited document covers a small amount of investigation not really answering his/her objections to labeling everything a Russian hack.

Nothing more to see here.

It's not as certain as the moon landings.

I agree Russia is almost certainly responsible. There is a ton of publicly available circumstantial evidence that points to them.

But without libpcap dumps showing what really went down, we can only take the word of various conflicted people.

It's totally possible the NSA had the hackers bugged, and even saw the order come in from their Russian handler, but we haven't seen anything like this ourselves.

You can download the malware samples and do forensics yourself.

http://contagiodump.blogspot.com.au/2017/02/russian-apt-apt2... has the ATP28 samples (do verify the hashes though!)

https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... has the techniques they used to identify developers. I agree it is circumstantial, but it's pretty strong and systemic.

I personally find this more compelling than a pcap which would just show the last jump.

I'm referring to dumps of the hackers themselves, detailing their chat logs, emails, bitcoin transactions, ssh traffic, etc. Not just the exploit-based traffic.

If I ran the NSA, I'd have every hacker group I could find under total surveillance.

I have video of the moon landings and the testimony of thousands of people that were physically involved.

> I'm referring to dumps of the hackers themselves, detailing their chat logs, emails, bitcoin transactions, ssh traffic, etc. Not just the exploit-based traffic.

Do you think this is how the NSA operates? They have that big ol' office building so they can email each other incriminating evidence, pay themselves with bitcoin, and ssh into rooted boxes from government facilities?

This is state-sponsored warfare, not script kiddies or hacker gangs.

It sounds like you're confused...I'm saying the NSA may have chat logs of the hacking group itself.

These "hacking groups" range from script kiddies that can barely phish, to world class programmers working with billions in resources.

Regardless of who did it, it's entirely possible that the NSA has damning evidence of what went down.

No, I think you're confused. I pointed out that:

* NSA is a top-tier state-sponsored actor.

* NSA doesn't leave chat logs, bitcoin transactions, or email logs lying around to be hacked.

* Another top-tier state-sponsored actor would act the same way (no chat logs).

* If a foreign state was behind those attacks, the NSA would not be able to find chat logs (because they don't exist).

* Therefore, your acceptance that the Kremlin was behind the attacks cannot depend on the NSA releasing that kind of evidence.

It's paradoxical. The evidence wouldn't exist if that fact held true. Honestly, I would be more suspicious if the NSA released the kind of evidence you were asking for.

Not to say it's true or false either. These are spy games, there's never 100% confidence...

My case as already been said better by others:

"In the physical world of crime investigation, common sense dictates that the perpetrator of a crime may use any weapon and not just one made in the country of his birth, and that the developer or manufacturer of the weapon most likely isn’t the criminal.

And yet, those seemingly crazy assumptions are made every day by cybersecurity companies involved in incident response and threat intelligence.

The malware was written in Russian? It was a Russian who attacked you.

Chinese characters in the code? You’ve been hacked by the Peoples Liberation Army."

https://medium.com/@jeffreycarr/the-dnc-breach-and-the-hijac...

"The person or persons responsible are unknown, but let’s assume that CrowdStrike is correct and the responsible party are Russian hackers employed by one or more of Russia’s intelligence services. They used APT28 malware developed and maintained by a Russian lab."

Another out-of-context quote from the same article...this is fun ;-)

No informed person is claiming Russia did it merely because it was "written in Russian". They're all basing it on many pieces of circumstantial evidence.

Don't crime investigators also look at the criminal history, motivations, and opportunity of the suspect?

I'd say you're doing a disservice to that author by taking his quote out of context. He's very clearly not making the simplistic straw man argument that you are.

It sounds like he suspects the Russians did it, as is rational, but wants real proof -- and not just circumstantial evidence. That is a totally reasonable demand.

>It sounds like he suspects the Russians did it, as is rational, but wants real proof -- and not just circumstantial evidence. That is a totally reasonable demand.

That is all I ask as well. Considering we are accusing a nation with nuclear weapons of an act of war the evidence must be much more than circumstantial. The FBI wasn't even permitted to investigate the server personally yet, let's start there instead of relying on private contractors paid by the DNC.

> of an act of war the evidence must be much more than circumstantial

When does "circumstantial" end? When there are "little green men" in Tallinn? How about Alaska?

>When does "circumstantial" end?

Why not just wire up the nuclear missile system to all government servers and launch should a Russian IP address be detected?

The idea that we can choose to ignore an attack on our sovereignty by a third-rate pariah state is beyond absurd.

The US is the super power here, not the other way around. We set the terms.

So war over a couple emails? I'd rather not servicemen die to retain the illusion that the DNC isn't corrupt.

The hacks didn't even reveal that.

They did, however, release personal information on donors as well as the dirt from American heros personal emails (Colin Powell and John McCain) who just happen to be anti-Putin.

Then how did they "hack the election" if the content was so benign?

Because our enemies even attempting to influence the election should be outrageous to a patriot.

The same enemies the Clinton sold all that uranium to? This narrative is falling apart.

You understand that you can't sell something you don't own, right?

HN has a max depth but here is a fantastic rebuttal to the absurd Uranium One allegations:

http://www.snopes.com/hillary-clinton-uranium-russia-deal/

I'll take the New York Times over an organization who's founder embezzled money to pay for escort services.

https://mobile.nytimes.com/2015/04/24/us/cash-flowed-to-clin...

The snopes article directly cites the NYTimes article. The entire ordeal is totally blown out of proportion (read: intentionally misread by the same people that think the DNC emails were damning), given Hillary had barely anything to do with it.

Payments made to Clinton tied organizations by Russian banks who profited off of a uranium deal days after the ink had dried = Nothing to see here

Cyrillic characters in a binary = Definitive evidence

Secret meetings with Kremlin-linked individuals days before the DNC hacks were first released and lying about why they were set up - nothing to see here.

Emails talking about collaboration with Russian government during the campaign to obtain damning information about Hillary Clinton released by his own son - nothing to see here.

Firing the director of the FBI "because of the Russia investigation" according to the man himself - nothing to see here.

Repeatedly downplaying the influence of Russia in Ukraine and changing the GOP platform after hiring a pro-Russian political operative to be his campaign manager - nothing to see here.

Repeatedly disagreeing with the evidence provided by American intelligence agencies and dozens of cybersecurity firms while agreeing with the statements of Russian intelligence after being president - nothing to see here.

Having a national security advisor who sat at the same table as Vladimir Putin in December 2015 during a gala for the state propaganda network - nothing to see here.

Having the same national security advisor lie about meeting the Russian ambassador - nothing to see here.

Having a campaign operative in Roger Stone (who he still in contact with) openly allege that he has a backchannel with Julian Assange - nothing to see here.

Peter Smith coordinating with Russian hacker groups, only to kill himself a few weeks after telling the WSJ? Nothing to see here!

....but a highly regarded charity founded by one of the most popular presidents in recent history raising money...now, that's a scandal!

I'll be honest, if our enemies are this afraid of someone, I want that person on my side.

> The malware was written in Russian? It was a Russian who attacked you.

You don't think that investigators can deal with misleading evidence? The country of origin is still a clue that can fit together with other clues.

I'd like to see what the FBI can learn if given access to the server, currently they have not been permitted access and all reports have come from third parties paid by the DNC. Similar third party accounts not funded by the DNC make claims that directly contradict the narrative portrayed by those who have been funded by them: http://www.zerohedge.com/news/2017-07-10/new-research-shows-...

The problem with 'how can you be sure' is that it is usually an attempt to cut off discussion and investigation, by implying that only irrefutable facts are admissible.

"by implying that only irrefutable facts are admissible"

lol.

I prefer living wage, non-gmo tautology free facts.

I'm not trying to cut off discussion. I was asking a genuine question because while it's entirely plausible the Russians did attempt to influence American politics a number of other scenarios are also entirely plausible. Are we just taking what the intelligence community say at face value now without seeing actual proof? That seems far more dangerous than whatever you're worried about. It's not like the US intelligence community have a flawless record when it comes to this type of activity either.

Sorry, you are right - statements like the one mentioned by rdtsc are fair game.

Or it's an attempt to find out and learn more.

If the claims is really something as serious as "Russians overturned the result of the election" it should come with very clear evidence. Otherwise it is conspiracy theory. Granted it is a good one and a great PR campaign. But I think it has run its course by and it's time to switch to something else.

I also heard about "17 intelligence agencies agreeing on the fact". Maybe 25th Air Force (one of the agencies) can tell us more about what they have found there.

> overturned the result of the election

The public IC statements very specifically noted that impact of RU efforts was not assessed, only the actions themselves.

You seem a bit stuck on this thing about there being 17 agencies.

It was a DNI statement on behalf of the 17 agencies of the intelligence community. That means none objected to it. For the purposes of that statement the most important were the NSA, the CIA and the FBI. The FBI took longer to sign off than the others because they weren't initially convinced about the part that says the aim was to get Trump elected. They didn't have any problems with the part about Russian meddling in the election though. Apparently they got some additional Intel because they signed in the end.

This is way those three agencies have this logo on the statement, along with the DNI, but the coastguard didn't.

The evidence pointing to Russia involvement in hacking the United States election is way more certain than the lack of evidence for an alternative scenario the drive-by downvoters are giving. :)

It's not like the United States or other countries have never been involved in similar hacking shenanigans. I mean, for instance: there is some interesting circumstantial evidence tying Stuxnet to United States and/or Israel intelligence agencies. "Officially", there is no proof tying Stuxnet to anything, that has been de-classified for now at least. But several intelligence intelligence agencies in Europe and the Middle East have concluded that Stuxnet is a US / Israel product.

Likewise, there is a lot of interesting circumstantial evidence typing Russia to the election hacking. Again, nothing 100% "certain" that is de-classified. But a lot of intelligence agencies have reached this conclusion. Added to this, I haven't seen any good counter-explanations.

Beyond mere intelligence agencies reaching this conclusion, there has been a lot of US government action related to this issue (in that Russian diplomats were expelled and sanctions were applied in part due to the election hacking). If all of that was for some illusion or show, that frankly would be strange to me.

"You never know", of course. But the probability of Russians being involved in the hacking seems very high.

Because all investigations from the three letter agencies agree on it.

We don't need to trust US agencies who claim "it was them but we can't tell you why"

There's a lot of evidence which came out before and during the attacks from non-government sources which points to the culprits.

I've posted this before, but I think it's important people understand what public evidence is available:

The 2014 report into ATP-28: https://www.fireeye.com/blog/threat-research/2014/10/apt28-a... presenting pretty compelling (if circumstantial) evidence that group is Russian state backed.

(July) 2016 report into the DNC hacking, showing it was first breached by ATP-29 (The other Russian state backed hacking group), but the leaks almost certainly came from a second breach by ATP-28 later: https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

Note the dates here. 2014 is way before anyone could claim some kind of anti-Trump deep state conspiracy. There's the Olympic hacks (which clearly benefited Russian interests) by the same group too.

Ironically, even Putin's comments on the matter are more credible: "Hackers are free people, just like artists who wake up in the morning in a good mood and start painting," he said. "The hackers are the same. They would wake up, read about something going on in interstate relations and if they feel patriotic, they may try to contribute to the fight against those who speak badly about Russia."[1]

That GP is being downvoted for stating this is disconcerting.

Thanks, but I'm not surprised. Feel free to correct it ;)

[1] http://www.zdnet.com/article/putin-says-russia-doesnt-hack-o...

GCHQ also flagged it in 2015:

https://www.theguardian.com/uk-news/2017/apr/13/british-spie...

> GCHQ first became aware in late 2015 of suspicious “interactions” between figures connected to Trump and known or suspected Russian agents, a source close to UK intelligence said. This intelligence was passed to the US as part of a routine exchange of information, they added.

Yeah, but I'm trying to only link to coverage dated before the election.

There's lots of additional evidence, but it's harder to argue with datestamps.

>No. But there is no national security or stability reason for them to lie about this

They don't have to be lying, they could just be mistaken. Is it not common for hackers to leave fake tracks pointing to someone else as a diversion?

sure, but Putin basically admitted Russia did it

https://www.nytimes.com/2017/06/01/world/europe/vladimir-put...

Regarding the trustworthiness of 'three letter agencies', two of them (DoD, JCS) approved plans for another (CIA) to commit terrorism against American civilians in order to justify a war against Cuba [1].

They could ultimately have America's best interests at heart, however you can be certain that their public statements have no standard of truth and are made to serve a covert agenda.

[1] https://en.wikipedia.org/wiki/Operation_Northwoods

One operation from over 50 years ago is your example? Back then the spooks were doing far worse, conducting operations against domestic civil rights groups.

That's a little different than a public DNI statement on behalf of 17 different agencies pointing to Russian attacks, corroborated by multiple other nations, in an era of wide-spread whistleblowing that would uncover a large-scale conspiracy.

Occam's Razor says all signs point to Russia.

I agree Russia is the most likely perpetrator, but it's all circumstantial from the evidence I've seen, and there's clearly a large sociopolitical impact from this hack.. hence it's substantial enough to be framed for some purpose.

I'm merely pointing out that we should question it when the U.S. government says "They did this!", as they've clearly tried to lie about it before in dire circumstances.

I wish I had more recent examples to give you, or examples that were actually executed on, however I think that'd be rather dangerous and impossible to obtain.

> One operation from over 50 years ago is your example? Back then the spooks were doing far worse, conducting operations against domestic civil rights groups.

Or torturing Americans civilians for eh... testing whether interrogation techniques would work on the real enemy(tm) as well.

> Russians were involved in a lot of hacking during the election, and a lot that has surfaced since, like intrusion into power plants, etc.

Any large enough country is involved in such activities. Iranians, Chinese, Israelis and North Koreans, Romanians, US false flags, private interests are probably able to hire people to work for them.

> 100% super double sure that we landed on the moon

Clearly you have just as good evidence that Russians hacked the election and overturned the result that is comparable to moon landing. A video perhaps, an audio recording, a chat log that can be verified, a confession from a credible source or a defector?

I hoping the vote recount would show some proof in Wisconsin but it turned out it gave Trump 3 more votes.

Yeah, serious allegation require more serious evidence to be believed. Otherwise it looks like a conspiracy theory.

And just like a conspiracy theory, if more people repeat it doesn't make it more true. If there are 10k contrails or lizard people making the same argument, it doesn't make the argument more true.

> How do we know this? Because all investigations from the three letter agencies agree on it.

The 17 intelligence agencies, including the Coast Guard Intelligence has irrefutable proof Russia overturned our election results?

The reason that the word of all 3 letter agencies is a gold standard for proof (just as good as the proof we have that we landed on the moon) is because they never lied to us before, or tried to do anything shady. /s

Just kidding. What should I cite? Everything awful the FBI did to MLK? That the NSA lied to us about domestic spying? The fact that Iraq was actually trying to disarm while the Bush admin and 3 letter agencies engaged in a cover up so as to not disrupt their plans in the ME?[1]

In fact, I'd like to know why I should trust 3 letter agencies because their accountability to the public right now seems to be nonexistent.

1 - https://theintercept.com/2016/12/15/if-donald-trump-is-so-up...

"The 17 intelligence agencies, including the Coast Guard Intelligence has irrefutable proof Russia overturned our election results?"

how is this relevant to anything? russia can have many aims in hacking during the election, besides actually overturning the election results. I am always amused by this zero or 1 logic.

Falsus in uno, falsus in omnibus.

Those that claim all 17 agencies had evidence when that is absurd (did Geospacial have evidence?) — making such a claim gives reason to doubt all the claims. I think was the point being made.

so the US propaganda machine has partially achieved its goal even on HN where people are expected (if I am not mistaken) not to take anything at face value.

More to the point, there were no credible investigations, "intrusion into power plants" was fake news, the FBI even hasn't up to this day examined the "hacked" DNC server.

Stop wondering whether or not Russia did it.

Putin admitted as much https://www.nytimes.com/2017/06/01/world/europe/vladimir-put...

> How can you be sure?

Don't go down this route.

Which "route"? The "asking questions" route?

You know that "only asking" is a well known trolling technique, right?

https://rationalwiki.org/wiki/Just_asking_questions

You may be right - that post does come off trolly-y, in retrospect.

You don't have to be. What's your point?

Reply on news.ycombinator.com